Regular Expression Denial-of-Service in Jackson Core by FasterXML

CVE-2026-89407

What is CVE-2026-89407?

The FasterXML jackson-core library contains a vulnerability in the NumberInput.looksLikeValidNumber() method that utilizes complex regular expressions to validate stringified numbers. This implementation can cause significant performance degradation, consuming excessive CPU resources and potentially exhausting application servers. The vulnerability arises from the backtracking nature of the regex patterns, which can lead to exponential matching costs based on input length. Attackers supplying crafted JSON data that an application deserializes could exploit this flaw, taking advantage of the lack of input length constraints prior to regex evaluation. The library versions before 2.17.0 are not affected, and a fix has been implemented that replaces the existing regular expressions with a more efficient single-pass scan.

References